CVE-2021-42321

🗓️ 10 Nov 2021 00:47:43Reported by microsoftType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 1787 Views🌐 WEB

Microsoft Exchange Server Remote Code Execution Vulnerabilit

Reporter	Title	Published	Views	Family All 44
0day.today	Microsoft Exchange Server Remote Code Execution Exploit	26 Feb 202200:00	–	zdt
0day.today	Microsoft Exchange Server ChainedSerializationBinder Remote Code Execution Exploit	22 Aug 202200:00	–	zdt
Gitee	Exploit for CVE-2021-42321	23 Nov 202111:33	–	gitee
GithubExploit	Exploit for CVE-2021-42321	23 Nov 202102:26	–	githubexploit
ICS	#StopRansomware: Hive Ransomware	25 Nov 202212:00	–	ics
ATTACKERKB	CVE-2021-42321	10 Nov 202100:00	–	attackerkb
Information Security Automation	Vulristics Command Line Interface, improved Product & Vuln. Type Detections and Microsoft Patch Tuesday November 2021	30 Nov 202120:30	–	avleonov
BDU FSTEC	The vulnerability of the Microsoft Exchange Server mail server, related to insufficient validation of command-line arguments, allows a hacker to execute arbitrary code.	10 Nov 202100:00	–	bdu_fstec
Circl	CVE-2021-42321	10 Nov 202104:00	–	circl
CISA KEV Catalog	Microsoft Exchange Server Remote Code Execution Vulnerability	17 Nov 202100:00	–	cisa_kev

NVD

Vulners

Node

microsoft exchange_serverMatch2016cumulative_update_21

microsoft exchange_serverMatch2016cumulative_update_22

microsoft exchange_serverMatch2019cumulative_update_10

microsoft exchange_serverMatch2019cumulative_update_11

[
  {
    "vendor": "Microsoft",
    "product": "Microsoft Exchange Server 2016 Cumulative Update 21",
    "cpes": [
      "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "15.01.0",
        "lessThan": "15.01.2308.020",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft Exchange Server 2019 Cumulative Update 10",
    "cpes": [
      "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "15.02.0",
        "lessThan": "15.02.0792.019",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft Exchange Server 2016 Cumulative Update 22",
    "cpes": [
      "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "15.0.0",
        "lessThan": "15.01.2375.017",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft Exchange Server 2019 Cumulative Update 11",
    "cpes": [
      "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "15.02.0",
        "lessThan": "15.02.0986.014",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  }
]

Source	Link
portal	www.portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42321
packetstormsecurity	www.packetstormsecurity.com/files/168131/Microsoft-Exchange-Server-ChainedSerializationBinder-Remote-Code-Execution.html
packetstormsecurity	www.packetstormsecurity.com/files/166153/Microsoft-Exchange-Server-Remote-Code-Execution.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description
build	path	ecp/{build}/exporttool/	Version-specific export tool endpoint used to validate target build and potentially trigger deserialization path.
GetFolder	request body	ews/exchange.asmx	SOAP-based Exchange Web Services endpoints used to perform deserialization, configuration changes and payload execution.
DeleteUserConfiguration	request body	ews/exchange.asmx	SOAP-based Exchange Web Services endpoints used to perform deserialization, configuration changes and payload execution.
CreateUserConfiguration	request body	ews/exchange.asmx	SOAP-based Exchange Web Services endpoints used to perform deserialization, configuration changes and payload execution.
GetClientAccessToken	request body	ews/exchange.asmx	SOAP-based Exchange Web Services endpoints used to perform deserialization, configuration changes and payload execution.
FolderId	request body	ews/exchange.asmx	SOAP-based Exchange Web Services endpoints used to perform deserialization, configuration changes and payload execution.
ChangeKey	request body	ews/exchange.asmx	SOAP-based Exchange Web Services endpoints used to perform deserialization, configuration changes and payload execution.
Dictionary	request body	ews/exchange.asmx	SOAP-based Exchange Web Services endpoints used to perform deserialization, configuration changes and payload execution.
BinaryData	request body	ews/exchange.asmx	SOAP-based Exchange Web Services endpoints used to perform deserialization, configuration changes and payload execution.

17 Jun 2026 04:09Current

9High risk

Vulners AI Score9

CVSS 26.5

CVSS 3.18.8

EPSS0.90388

SSVC

In Wild